cbcvebase.
CVE-2022-0786
published 2022-06-13

CVE-2022-0786: The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with…

PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
11.48%
95.5th percentile
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users

Affected

1 ranges
VendorProductVersion rangeFixed in
iqonickivicare< 2.3.92.3.9

Detection & IOCsextracted from sources · hover to see the quote

otherajax_post AJAX action with get_doctor_details route↗
sigma
status_code == 200 AND contains(content_type, "text/html") AND contains(body, "Doctor details")
  • →Monitor unauthenticated POST requests targeting the WordPress admin-ajax.php endpoint with action=ajax_post and route=get_doctor_details for SQL injection payloads in parameters. ↗
  • →A successful exploitation response will return HTTP 200 with content-type text/html and body containing the string 'Doctor details'; alert on this pattern in WAF/proxy logs.
  • →The vulnerability is exploitable by unauthenticated users; no session cookie or authentication token is required, so filter for anonymous requests to admin-ajax.php matching the above action/route combination. ↗
  • ·Vulnerability affects KiviCare WordPress plugin versions before 2.3.9 only; ensure version scope is confirmed before deploying detections to avoid false positives on patched installations. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.